rg99 Privacy Policy

For the purposes of applicable data protection legislation, rg99 is the data controller in respect of personal data collected through the Platform. rg99 determines the purposes for which and the manner in which personal data is processed.

If you have any questions regarding this Privacy Policy or the processing of your personal data by rg99, please contact our Data Protection contact via the support email displayed in the footer of this page. rg99 commits to acknowledging all data-related enquiries within five (5) business days.

rg99 collects personal data in the following categories:

2.1 Registration Data

• Full legal name as it appears on a government-issued identification document.
• Date of birth (for age verification purposes — rg99 is a 21+ platform).
• Registered mobile number (used as the primary account identifier and for two-factor authentication).
• Email address (for account communications and password recovery).
• Residential address.

2.2 Identity Verification (KYC) Data

• Copy of Malaysian MyKad, passport, or other government-issued photo identification.
• Proof of address documentation (utility bill or bank statement, not older than three months).
• Proof of payment method ownership where required for withdrawal processing.

2.3 Financial Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references.
• e-Wallet account identifiers (Touch n Go eWallet, Boost) and bank account details for FPX transactions — held only in tokenised or partial form.

2.4 Gaming Activity Data

• Game session logs, bet histories, win/loss records, and account balance history.
• Responsible gaming settings and any self-imposed limits or exclusions applied to the account.

2.5 Technical & Usage Data

• IP address, device type, browser type and version, operating system.
• Session timestamps, pages visited, click-stream data, and referral source.
• Cookie data as described in Section 6 of this Policy.

2.6 Communications Data

• Records of live chat conversations, email correspondence, and any other communications between you and rg99 support.

rg99 uses personal data for the following purposes:

• Account management: Creating, maintaining, and securing your rg99 account, including authentication and two-factor verification.
• Age and identity verification: Confirming that Members meet the 21+ age requirement and verifying identity for KYC compliance.
• Payment processing: Processing deposits and withdrawals, verifying payment method ownership, and preventing fraudulent transactions.
• Regulatory compliance: Meeting anti-money laundering (AML), counter-terrorism financing (CTF), and other applicable regulatory obligations, including reporting to relevant authorities where required by law.
• Platform security: Detecting, investigating, and preventing fraudulent activity, account abuse, and prohibited conduct as defined in the rg99 Terms & Conditions.
• Customer support: Responding to enquiries, resolving disputes, and providing account assistance.
• Responsible gaming: Monitoring gaming patterns to identify indicators of problem gambling and administering self-exclusion or limit requests.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates — subject to your marketing preferences and opt-out rights.
• Platform improvement: Analysing aggregated usage data to improve Platform performance, game selection, and user experience.

rg99 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between rg99 and the Member (account operation, payment processing, game access).
• Legal obligation: Processing required to comply with applicable regulatory requirements, including AML and KYC obligations.
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by the data subject's rights and interests.
• Consent: Processing for marketing communications, where consent has been obtained and may be withdrawn at any time.

5.1 rg99 does not sell, rent, or trade personal data to third parties for commercial marketing purposes.

5.2 rg99 may share personal data with the following categories of third parties in the course of operating the Platform:

• Payment processors and e-wallet providers: To facilitate deposits and withdrawals (Touch n Go eWallet, Boost, FPX banking partners). These providers act as independent data controllers in respect of transaction data they process.
• Game software providers: Game session data is transmitted to and processed by third-party game studios (Evolution Gaming, Pragmatic Play, PG Soft, etc.) for the purpose of game operation and dispute resolution.
• KYC and identity verification services: Identity document data may be processed by certified third-party verification providers acting as data processors under rg99's instruction.
• Regulatory authorities: rg99 may be required by law or by its licensing authority to disclose Member data to relevant government bodies, law enforcement agencies, or financial intelligence units.
• Professional advisors: Lawyers, accountants, and auditors, where disclosure is necessary for legitimate professional purposes and subject to confidentiality obligations.

5.3 Where rg99 engages third-party data processors, it requires them to implement appropriate technical and organisational measures to protect personal data and to process data only on rg99's documented instructions.

6.1 rg99 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function, including session authentication, login state persistence, and security tokens. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data on how Members use the Platform — pages visited, session duration, game preferences — to improve Platform performance and design.
• Marketing cookies: Used, with your consent, to deliver relevant promotional content and to measure the effectiveness of marketing campaigns. You may opt out of marketing cookies at any time through your browser settings.

6.2 Most browsers allow you to manage or disable cookies through browser settings. Disabling essential cookies will impair your ability to use the rg99 Platform, including the ability to log in to your account.

7.1 rg99 implements industry-standard technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and rg99 servers.
• Encryption of stored personal data and KYC documents at rest.
• Role-based access controls restricting employee access to personal data on a need-to-know basis.
• Regular security assessments and penetration testing of rg99 platform infrastructure.
• Two-factor authentication available to all Members to protect account access.

7.2 In the event of a data breach that poses a risk to Members' rights and freedoms, rg99 will notify affected Members and relevant regulatory authorities within the timeframes required by applicable law.

8.1 rg99 retains personal data for the following periods:

• Active account data: Retained for the duration of the Member's account plus a minimum of five (5) years following account closure, in compliance with AML regulatory requirements.
• KYC verification documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for a minimum of seven (7) years for financial audit and AML compliance purposes.
• Marketing data: Retained until you withdraw consent or opt out of marketing communications, after which it is removed from active marketing lists within 30 days.
• Support communications: Retained for a period of three (3) years from the date of the communication, for service quality and dispute reference purposes.

8.2 Following the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

Subject to applicable data protection law, you have the following rights in respect of your personal data held by rg99:

• Right of access: The right to request a copy of the personal data rg99 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to rg99's legal and regulatory retention obligations.
• Right to restriction: The right to request that rg99 restrict the processing of your personal data in certain circumstances.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact rg99 support via live chat or at the email address in the footer. rg99 will respond within thirty (30) days. Identity verification may be required before rg99 can action your request.

The rg99 Platform is strictly intended for persons aged 21 years and above. rg99 does not knowingly collect or process personal data relating to persons under the age of 21. If rg99 becomes aware that personal data has been submitted by or on behalf of a person under 21, the associated account will be immediately closed and any personal data held will be securely deleted. If you have reason to believe that a minor has created an rg99 account, please notify rg99 support immediately.

The rg99 Platform does not contain links to third-party websites that are not controlled by rg99. Where rg99 engages third-party service providers (game studios, payment processors), those providers operate under their own privacy policies and data protection practices. rg99 is not responsible for the privacy practices of third-party game studios or payment processors in their capacity as independent data controllers. We encourage you to review the privacy policies of any third-party services you interact with.

rg99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, Platform functionality, or applicable law. Where updates are material, rg99 will notify active Members via their registered email address or via a notice displayed upon login, at least seven (7) days prior to the changes taking effect. The most current version of this Policy is always available at rg99.app/privacy-policy. Continued use of the Platform following the effective date of updates constitutes acceptance of the revised Policy.

For all privacy-related enquiries, data subject rights requests, or complaints regarding rg99's handling of your personal data, please contact the rg99 support team via live chat (available 24/7 on the Platform) or by email at the address displayed in the footer of this page.

rg99 will acknowledge all data-related enquiries within five (5) business days and will endeavour to resolve them within thirty (30) days. Where a complaint cannot be resolved directly, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.